CVE-2024-5133: lunary-ai/lunary · Information Exposure
Affects lunary-ai/lunarySource CVE Database V5
Not known to be exploited · CVSS 9.1 Critical.
Data as of 26 Oct 2026, 14:05 UTC
- EPSS
- 0.5% chance of exploitation in 30 days – higher than 45% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NExploitation evidence
Disclosed: evidence found.
CVE published 6 Jun 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
GitHublunary-ai/lunarypkg:github/lunary-ai/lunaryOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
- Immediately audit API responses to ensure that sensitive attributes such as recovery_token are not included in any user or team listing endpoints.
- Remove the recovery_token attribute from the GET /v1/users/me/org endpoint and any other API responses accessible to authenticated users.
- Implement strict access controls and role-based permissions to restrict who can view sensitive user information, especially password reset tokens.
- Enhance the password reset workflow to require additional verification steps beyond possession of a recovery token, such as email confirmation or multi-factor authentication.
- Monitor logs for unusual password reset activity or API calls that could indicate exploitation attempts.
- Coordinate with lunary-ai to obtain and apply patches or updates that address this vulnerability once available.
- Educate users about the importance of securing their accounts and recognizing suspicious password reset notifications.
- Consider implementing anomaly detection to identify abnormal API usage patterns that may signal exploitation.
- Review and update incident response plans to include scenarios involving account takeover via exposed recovery tokens.
- For organizations with sensitive data, consider additional compensating controls such as network segmentation and enhanced monitoring until the vulnerability is fully remediated.
Description
In lunary-ai/lunary version 1.2.4, an account takeover vulnerability exists due to the exposure of password recovery tokens in API responses. Specifically, when a user initiates the password reset process, the recovery token is included in the response of the `GET /v1/users/me/org` endpoint, which lists all users in a team. This allows any authenticated user to capture the recovery token of another user and subsequently change that user's password without consent, effectively taking over the account. The issue lies in the inclusion of the `recovery_token` attribute in the users object returned by the API.